Main Flashcards
(281 cards)
1
Q
Prepending
A
Two seperate definitions
1. Making a message appear more trustworthy by adding text before the message. E.g adding [SAFE] to the subject of an email.
2. Url high hijacking technique where the attacker puts text at the beginning of their typosquatted URL https://pprofessormesser.com/
2
Q
Pharming
A
Similar to phishing but attacking DNS in order to redirect to your malicious site in order to harvest credentals.
3
Q
Pretexting
A
A fictitious scenario added to a conversation to make a request more believable. Used by attackers in social engineering.
4
Q
Hoaxes
A
A threat that doesn’t actually exit.
e.g Email chain about fake cyber attack
5
Q
Methods for identifying spam
A
- Allowed list, trusted senders
- SMTP standards checking, block emails that don’t meet RFC standards
- rDNS, reverse DNS, block email where sender’s domai doesn’t match IP address
- Tarpitting, intentionally slow down server conversation
- Recipient filtering, block all email not addressed to valid recipient email address
6
Q
Credential harvesting
A
Grabbing all the credentials stored on a PC, phone, etc
7
Q
Principles of Social Engineering
A
- Authority
- Intimidation
- Consesus / Social Proof
- Scarcity
- Urgency
- Familiarity / Liking
- Trust
8
Q
Types of malware
A
- Virus
- Crypto-malware
- Ransomware
- Worms
- Trojan horse
- Rootkit
- Keylogger
- Adware/Spyware
- Botnet
9
Q
Virus
A
Malware that can reproduct itself through file systems or network. Key difference between worms: Virus requires user input to spread, like opening a malicious file
10
Q
Worms
A
Malware that self-replicates across a network with no user interaction
11
Q
Crypto-malware
A
Newer generation of ransomware, pay the bad guys for your data back. This is what you think of when you think “ransomware”
12
Q
Ransomware
A
Malware that attempts to extort money from the target. May or may not encrypt data
13
Q
Trojan horse
A
Malware that pretends to be something else, e.g Rouge AV
14
Q
Rootkit
A
Malware that modifies core system files, can be invisible to the operating system and traditonal AV
e.g Malicious kernel drivers
15
Q
Rainbow tables
A
Optimized pre-built set of hashes
16
Q
Salt
A
Random data added to password when hashing. Every user gets own random salt. Stops rainbow tables. Slow down brute force process. Same password will create different hashes depending on the salt.
17
Q
Machine learning attacks
A
- Poison the training data
- Find ways to evade the AI. E.g Holes in an AI based IPS or IDS
18
Q
Birthday attack
A
Find a collison through brute force. Generate multiple versions of plaintext to match hashes.
19
Q
Downgrade attack
A
Attacker forces the system use a worse form of encryption if it is supported.
20
Q
Replay attack
A
Gather network information with a tap ARP poisoning, malware, or protocol analyzer. Then resend the information collected to the server, maybe it will be accepted as valid.
21
Q
SSRF
A
Server side request forgery. Attacker tells the web server to do something, and it does it. Caused by bad programming and not checking for who sent the request.
22
Q
Shimming
A
Code that acts as an adapater for backwards compatibility. Often written by malware developers.
23
Q
Metamohpric Malware
A
Refactors itself to make it appear different each time. Intelligently redesigns itself.
24
Q
SSL Stripping / HTTP Downgrade
A
Attacker sits in middle of conversation between victim and server. Attacker essentially has all the encryption keys, so it can decrypt the HTTPs data, giving plaintext. Attacker reads everything, but the victim thinks he’s running HTTPS the entire time.
25
Bluejacking
Sending unsolicited messages to another device via bluetooth
26
Bluesnarfing
Access a bluetooth-enabled device and transfer data
e.g Contact list, calendar, email, pictures, video, etc
27
Cryptographic nonce
Arbitrary number that is used only once in a cryptograhic process. Usually a random or psuedo-random number or a counter. A salt is an example of a nonce.
28
Initalization Vector (IV)
Type of nonce. Used for randomizing an encryption scheme.
29
MAC Flooding
Filling up the MAC table on a switch, forcing ou tthe legitmate MAC addresses. The switch will begin to flood out on all interfaces, turning the switch into a hub. Attacker can then easily capture all network traffic.
30
DNS poisoning
Modify the DNS server, change it so that DNS lookups give the responses that the attacker desires. Can be used to highjack domains, get victims to go to your malicious site, DOS.
31
URL Highjacking Techniques
1. Typosquatting / brandjacking, takes advantage of poor spelling
2. Outright mispelling
3. Typing error
4. Different phrase in URL
5. Different top-level domain, e.g .org instead of .com
32
Types of threat actors
1. Insiders
2. Nation states
3. Hackitivst
4. Script kiddies
5. Hackers
6. Shadow IT
7. Organized crime
8. Competitors
33
Broad categories of threat intelligence
1. Open source
2. Closed/proprietary
34
Threat intelligence sources
1. Vulnerability databases
2. Information-sharing centers
3. Automated indicator sharing (AIS)
4. Indicators of compromise (IOC)
5. Predictive analysis
6. Dark web intelligence
7. File/code repos
8. Threat maps
35
Automated Indicator sharing (AIS)
Enables real-time exchange of machine-readable cyber threat indicators through a server/client architecture for communications.
36
TTP
Tactics, techniques, procedures used by adversaries
37
Threat hunting
Find the attacker before they find you
38
Types of vulnerability scans
1. Non-intrusive
2. Intrusive
3. Credentialed
4. Non-credentialed
39
Syslog
Standard for message logging, needs a lot of disk space, used on central log collector integrated into the SIEM
40
SOAR
Security orchestration, automation, and response
1. Orchestration - Connect many different tools together
2. Automation - Handle security tasks automatically
3. Response - Make changes immediately
41
Pentester's process
0. Recon / footprinting
1. Inital exploitation
2. Lateral movement
3. Persistence
4. Pivoting
42
Security teams
1. Red team
2. Blue
3. Purple - Red and blue working together
4. White - Refs
43
Baseline configuration
Established reference point for integrity measurement checks.
44
Data masking
Techniques used to obfuscate sensitive data
45
Data states
1. At rest
2. In transit - Over network
3. In use - Ram
46
Tokenization
Replace sensitive data with non-sensitive placeholder
47
IRM
Information Rights Management.
Technology used to limit the scope of what users can do with data. e.g Preventing copy past, screenshotting, printing, etc
48
Site resilliency: Types of sites
1. Hot - Exact replica
2. Warm - Between hot and cold
3. Cold - Electricity, building, not much else
49
DNS Sinkhole
DNS that hands out incorrect IP addresses
50
Types of cloud models
1. IaaS Infrastructure as a service - Sometimes called hardware as a service
2. PaaS Platform - Someone else handles the platform you handle development, no servers, no software, no maintenance team, no HVAC
3. SaaS Software - On demand software, no local installation
4. XaaS Anything - Broad description of all cloud models
51
0 octal
000
52
1 octal
001
53
2 octal
010
54
3 octal
011
55
4 octal
100
56
5 octal
101
57
6 octal
110
58
7 octal
111
59
Data governance
Processes used by an organization to manage, process, and protect data. Used to ensure availability, readability, integrity, and security of data. Also, used to comply with external laws and regulations.
60
HIPAA
Health insurance portability and accountability act. A data governance regulation. Mandates that organizations protect health information.
61
GLBA
Gramm-leach Bliley act. Data governance regulation that requires financial institutions to provide consumers with a privacy notice explaining what information they collect and how it is used.
62
SOX
Sarbanes-oxley act. Data governance regulation that requires that executives take individual responsibility for the accuracy of financial reports.
63
GDPR
General data protection regulation. Data governance regulation that mandates the protection of privacy data for individuals who live in the EU
64
Data retention policy
Specifies how long data is retained and sometimes specifies where it is stored.
65
Blank
TCP 21, 22
66
SSH Port
TCP 22
67
DNS Port
53 tcp for zone transfers
53 udp for name resolution queries
68
NTP Port
UDP 123
69
BGP
Border gateway protocol
Enables exchange of routing information between autonomous systems
TCP 179
70
IPSec port
Uses internet key exchange (IKE) over port 500 UDP
71
RDP port
TCP 3389
72
POP3, secure POP ports
TCP 110 unencrypted
TCP 995 encrypted
73
Imap4 and encrypted imap ports
TCP 143 unencrypted
TCP 993 encrypted
74
Smtp and smtp-over-TLS port
TCP 25 unencrypted
TCP 587 for email encrypted with tls
75
Telnet port
TCP 23
76
FTP ports
Active mode: TCP 21 control signals, TCP 20 for data
Passive mode: TCP 21 control signals, random TCP port for data
77
Sftp
TCP 22
Secure FTP
Inherently secure. Unlike FTPS, which just adds a layer of security with TLS. Both are secure though.
Used by SSH for file transfers. Not FTPS!
78
LDAP, LDAPS
Lightweight Directory Access Protocol
LDAP TCP 389
LDAPS TCP 636
LDAP specifies the formats and methods used to query directories. Commonly is used to store information for authentication.
79
SSTP ports
Secure socket tunneling protocol
Encrypts VPN traffic using tls on port TCP 443
80
TFTP Port
Trivial file transfer protocol
UDP 69
81
Kerberos port
UDP 88
82
Ping
Ping -t 172.26.5.1, continuous
Ping -c 4 172.26.5.1, 4 times
83
Ipconfig
Ipconfig /all
Ipconfig /flushdns, flush dns cache
Ipconfig /displaydns, show dns cache
84
Ifconfig
Ifconfig -a, similar to ipconfig /all
Ifconfig eth0, show conf. eth0
Ifconfig eth0 promisc, enable promisc mode, process all traffic
Ifconfig eth0 allmulti, enable multicast mode, process all multicast traffic
Ifconfig eth0 -allmulti, disable multicase mode
85
Ip (tool)
Ip link show, show interfaces
Ip link set eth0 up, enable eth0
Ip -s link, show network stats
86
Netstat
Netstat -a, show all tcp udp ports being listened on
Netstat -r, show routing table
Netstat -e, show network stats
Netstat -s, show net stats for specific protocols
Netstat -n, show addresses and ports in numerical order
Netstat -p protocol, show stats on specific protocol
Netstat, show open TCP connections
You can combine options. E.g netstat -anp tcp
87
Tracert
Windows
tracert google.com, show hops between system and Google
racert -d google.com, don't resolve IP addresses to host names, makes command faster
88
Traceroute
Linux
Traceroute -n google.com, don't resolve IPs
89
Pathping
Sends pings to hops on routes. Computes statistics depending on responses to pings.
Pathping -n google.com
If a hop has 100% packet loss. Chances are it is just blocking icmp. If it really is bad, then all other hops from that point on in the path must also be dropping 100%.
90
Arp
Windows and Linux
Arp, help on windows, arp cache linux
Arp -a google.com, show arp cache entry for specified ip
Arp -a, show entire cache on windows
91
Tail
Tail -n 15 /var/log/messages, show last 15 lines.
Tail /var/log/messages, show last 10 lines
92
Logger
Linux
Add entires to /var/log/syslog
93
Journalctl
Linux
Query linux system logging utility called journald.
Journalctl -- since "1 hour ago", show logs only in journals.
Journalctl --list-boots, show boot logs
94
FAR
False acceptance rate
Biometrics
95
FRR
False rejection rate
Biometrics
96
CER
Crossover error rate
Point on graph of sensitivity (x), error percentage (y), where FAR and FRR intersect. Increasing or decreasing sensitivity at this point will cause one of the error rates to go up and the other to go down. Lower CER means a better biometric accuracy.
97
Role-BAC
Role based access control
Uses roles to manage rights and permissions for users. Roles are often implemented as groups. Think Microsoft security groups.
Admins have complete access
Executives have access to data on any project on server but can't change server settings
Project managers have full control over their own projects but not any other teams projects
Team members can do work that project managers assign them but have little access outside of it.
98
Rule-BAC
Rule based access control
Uses rules. Common example is rules in routers and firewalls, which use access control lists to contain and organize the rules. Some rules are static, others might be modified on the spot.
99
DAC
Discretionary access control
Objects (files, folders, etc) have an owner, the owner establishes access for the objects. Example is NTFS used in windows, which allows users and administrators to restrict access to files and folders with permissions.
100
SID
Security identifier. Used in windows discretionary access control. Long string of characters used to identify users.
101
MAC (not network)
Mandatory access control
Uses labels to determine access. Admins assign labels to objects and users. If the labels match, then the user has access. Example SELinux. A lattice chart is used to layout the scheme.
102
ABAC
Attribute-based access control
Evaluates attributes and grants access based on the value of these attributes. Example, Homer has attributes employee, inspector, nuclear aware. A file server has a share called inspector, that grants access to the folder for any user that has the attributes employee, inspector, nuclear aware.
Many SDNs use ABAC schemes instead of rules on physical routers.
103
Conditional access
Used with traditional access control schemes but adds additional capabilites with if then statements. Policies in conditional access use signals which are similar to attributes in an ABAC scheme. Implemented in Microsoft azure active directory.
104
Jump server
Hardened server used to access and manage devices in another network with a different security zone.
105
Screened subnet
Aka DMZ. Buffered zone between a private network and the internet. Will contain some internet facing servers surrounded by firewalls such that the internal network is protected.
106
Network address translation gateway
Hosts NAT and provides internal clients with private IPs a path to the internet.
107
Zero trust network
Doesn't trust any device by default even if the device was previously verified. Security model based on the principle of Zero trust. Can be implemented by requiring multifactor authentication.
108
UTM
Unified threat management
Single solution that combines multiple security controls. An appliance that performs URL filtering, malware inspection, content inspection, DDoS mitigation, etc
109
MSP
Managed Service provider. A cloud service provider that provides network connectivity managment, backup and disaster ecovery, growth management and planning
110
MSSP
Managed Security Service Provider. A cloud service provider for firewall management, patch managemnt, security audits, emergency response.
111
Fog computing
Cloud that's close to your data. Cloud + IOT = Fog computing. Immeditate data stays local so no latency. No bandwith requirements. Privdate data never leaves - minimizes security concerns. Local decisons made from local data.
112
Eslasticity
Scale up, down, out and in as it is required (automatically)
113
FaaS
Function as a service. Applications are seperated into indvividual, autonomous functions. Remove operating system from the equation. Runs in stateless compute container.
114
VPC
Virtual private cloud. Pool of resources created in a public cloud.
115
SDN
Software Defined Networking. (Infrastructure as code)
116
SDV
Software Defined Visibility. (infrastructure as code)
117
Deployment stages
1. Test - Still in development
2. QA
3. Staging - Looks and feels like a production environment
4. Production
118
SQL Secure coding
1. Stored procedures
119
Software diversity
Using alternative compiler paths to result in a different binary each time compiled. An exploit for one version of the binary should not affect many others.
120
Continuous Integration
Code constantly written and merged int ocentral repo everyday.
121
CD
Continuous delivery/deployment. Continuous delivery means automate the testing and release process, cllick and button and deploy the application. Continuous deployment means automatically deploy to production with no human integration or manual checks.
122
Federation
Providing network access to thrid parties such as partners, suppliers, customers, etc. A federated network allows authentication between two organization.
123
Attestation
Prove the hardware is really yours.
124
TOTP
Time based one time password. Secret key and time of day, no counter.
125
HOTP
HMAC based one time password. Based on secret key and counter.
126
Biometric authentication methods
1. Fingerprint
2. Retinal
3. Iris
4. Voice recognition
5. Facial
6. Gait anlysis
7. Veins
127
AAA
Idebtification, Authetication, authorization, accounting
128
Factors of authentication
1. Something you are
2. Somewhere you are
3. Something you can do - Handwriting analysis, you're special
4. Something you know
5. Something you have
129
Disk redundancy techniques
1. Multipath I/O
2. RAID
3. Multiple drives
130
RAID types
1. RAID 0 - Striping without parity, high performance, no fault tolerance
2. RAID 1 - Mirrioring, Duplicates data for fault tolerance but requires twice the disk space
3. RAID 5 - Striping with parity, Fault tolerant and only requires an additonal disk for redunancy
4. RAID 0+1, RAID 1+0, RAID 5+1, Multiple raid types, Combine raid methods to increase redundancy
131
Network redundancy techniques
1. Load balancing
2. NIC teaming
132
Power redundancy techniques
1. UPS
2. Generator
3. Dual pwoer supply
4. PDU - Power distribution unit, provides power to multiple power outlets usually in a rack
133
Backup types
1. Full
2. Incremental - All changes since last incremental
3. Differential - All changes since last full
134
NAS
Network attached storage. Connect to a shared storage device across the network and get file-level access to it.
135
SAN
Storage area network. Looks and feels like a local stroage device. Block level access, very efficient reading and writing.
136
HA
High availability
137
SoC
System on a chip. Multiple components running on a single chip, common with embedded systems.
138
FPGA
Field Programmable gate array Integrated circuit that can be configured after manufacturing. Common in firewall logic and routers.
139
ICS
Industrial control systems. Like SCADA
140
RTOS
Real time operating system. OS with a deterministic processing schedule. No time to wait for other processes. Found in industrial equipment, automobiles, and military environments. Extremely sensitive to security issues.
141
SIM
Subscriber identity module. SIM card.
142
Narrowband
Form of embedded system communication. Communicate analog signals over a narrow range of frequencies.
143
Baseband
Form of embedded systems communication. Generally a single cable with digital signal, copper or fiber. Uses all bandwith, utilization either 0% or 100%.
144
Air gap
Physical seperation between networks.
144
Zigbee
IOT Networking open standard. Alternative to WiFi or bluetooth. Longer distances than bluetooth, less power consumption than WiFi.
144
Cipher
Algorithm uses to encrypt and/or decrypt
145
Ciphertext
Encrypted message
146
Key strengthing techniques
1. Key streching - Larger keys tend to be more secure
147
HE
Homomorphic encryption. Perform calculations on data white it's encrypted.
148
Symmetric vs asymmetric encryption
1. Symmetric - Doesn't scale well
2. Symmetric is faster
149
ECC
Eliptic curve cryptography. Asymmetric.
150
Digital signature
Prove message was not changed - Integrity. Prove source of message - Authentication. Make sure signature isn't fake - Non-repudiation.
151
PFS
Perfect forward secrecy. Refers to encryption system that changes the keys used to encrypt and decrypt.
152
Stream cipher
Encryption is done one bit or byte at a time. High speed, low hardware complexity. Used with symmetric encryption. Starting state should never be the same twice. Often combined with an IV
153
IV
Initalization vector
154
Block cipher
Encrypt fixed-length groups. Used with symmetric encryption. Different modes of operations. e.g ECB, CBC, CTR, GCM
155
ECB
Electronic code block. Block cipher mode of operation. Simplest mode. Each block encrypted with same key, identical plaintext blocks create identical ciphertext blocks.
156
CBC
Cipher block chaining. Mode of block cipher operation. Each plaintext block is XORed with the pevious ciphertext block.
157
CTR
Counter. Mode of block cipher operation. Block cipher acts like a stream cipher, encrypts successive values of a counter.
158
GCM
Galois/Counter mode. Mode of block cipher operation. Combines counter mode with galois authentication. Very efficient encryption and authentication. Commonly used with packetized data such as in TLS.
159
SRTP
Secure Real-Time transport protocol.
Secure protocol for audio and video traffic.
160
S/MIME
Secure/Multipurpose Internet mail extensions
Public-private key encryption mechanism that allows for the protection of the information within emails. As well as digital signatures for integrity. Requires PKI.
161
SNMPv3
Simple Network Management protocol version 3. Secure protcol for managing network devices.
162
EDR
Endpoint detection and response. Detecting threats on an endpoint, investigating, and responding.
163
DLP
Data loss prevention
164
TPM
Trusted platform module. Specification for cryptographic functions. Hardware to help with cryptographic functions.
165
East-west and North-south traffic
East-west traffic - Traffic between devices in the same data center.
North south traffic - Ingress/egress to an outside device
166
L2TP
Layer 2 tunneling protocol. Commonly implemented with IPSec. Can be used as a tunneling protocol for VPNs.
167
AH
Authentication header. Member of the IPSec protocol suite.
168
ESP
Encapsulating security payload. Member of the IPSec protocol suite.
169
IPSec modes
Transport mode. Tunnel mode.
170
QoS
Quality of service. Describes process of controlling traffic flows.
171
FIM
File integrity monitoring. Some files should never change.
172
Stateless firewall
Does not keep track of traffic flows.
173
Stateful firewall
Keeps track of traffic flows. Remembers the "state" of the session.
174
WAF
Web application firewall.
175
COPE
Corporate owned personally enabled. Device deployment model. Employees free to use device as if it was their personally owned device. But the organization purchases it and owns it.
176
BYOD
Bring your own device. Device deplyoment model. Employees can being their own mobile device to work and attach them to the network. Employee is responsible for selecting and supporting the device, typically must comply with a BYOD policy when connecting to the network.
177
CYOD
Choose your own device. Device deplyoment model. Employees selects a device from a list of acceptable devices. Employee purchases and brings the device to work.
178
HSM
Hardware security module. High end cryptographic hardware.
179
CEO Fraud
Sending fake emails from senior executives.
180
Invoice fraud
Impersonating a trusted colleague or vender to request payment or money transfer,
181
Footprinting
Gathering information about computer systems and their entities.
182
Virus hoax
Typically harmless messages that spread through social engineering often using sensational claims and urging users to forward the message to warn others about a fake cyber threat.
183
Watering hole attack
Attempts to discover which **websites** a group of people are likely to visit and then infects those websites with malware that can infect the visitors/
184
Influence campaign
Hacking public opinion. Often run by nation state actors to divide individuals or persuade them. Frequently performed using social media with lots of fake or bot accounts, and relies on real users to spread the misinformation.
185
Change control meetings
Discussing changes to IT infrastructure. Important to use standaridzed naming and numbering conventions in ensure efficient communication during such meetings.
186
Confusion (encryption)
Ensures ciphertext is very different from the original plaintext.
187
Diffusion (encryption)
Ensures that a small change in the plaintext results in a significant change in the ciphertext.
188
DNSSEC
Domain Name System Security Extension. Provides a means of validating the information recieved from a DNS server so that it really did come from the server that was requested and that the information was not changed as it went through the network.
189
FTPS
TCP 989, 990
File transfer protocol secure.
Uses TLS or SSL to encrypt FTP. Unlike SFTP, not inherently secure, just an added layer of security with TLS/SSL.
190
Phishing
Creating a fake website or communication that closely resembles an authentic one to deceive users.
191
Principles of social engineering
1. Authority
2. Scarcity
3. Familiarity
4. Intimidation
5. Consensus
6. Urgency
7. Trust
192
TAXII
Trusted Automated eXchange of Indicator Information.
An open standard that defines a set of services and messages exchanges used to share information. Provides a standard way for organizations to exchange cyber threat information.
193
STIX
Structured Threat Information eXpression.
An open standard that indentifies what cyber threat information organizations should share. Provides a common language for addressing a wide range of cyber threat information. STIX data is shared via TAXII.
194
Known-plaintext attack
Attacker knows both plaintext and its corresponding ciphertext. He uses this information to determine the encryption/decryption method and perhaps reveal keys. He can then decrypt all messages.
195
Chosen plaintext attack
Attacker knows the ciphertext but not all of the plaintext, only a "chosen" part of it. He then uses various techniques to attempt to decrypt the chosen part, which will allow him to decrypt all messages.
195
Ciphertext only attack
Attacker doesn't have any information on the plaintext. He must work with the ciphertext only.
196
DHCP Starvation
Attacker floods network with IP address lease requests. DHCP server runs out of IPs.
197
Horizontal Priv esc
Attacker gains access to resources that would only normally be available to a user of a higher privledge level. Does not necessarily have to be an administrator or root account.
198
Veritcal Priv esc
Attacker gets administrative or root access to a system via a vulnerability
199
TOCTOU
Time of check to time of use attack
Attacker exploits a race condition in order to do somethign malicious with data after the operating system verifies access is allows (time of check) but before the operating system performs a legitmate action (time of use)
200
Rogue AP
An AP placed wthin a network without official authorization. Might be used to bypass security and gain access to the network or to sniff traffic. 802.1X authentication can prevent this by requiring users to provide a username, password or other type of authentication before being allowed access to the network.
201
EAP
Authentication method for wireless networks. However, it can also be used anywhere an 802.1x server is used. Provides method for two systems to create a secure encryption key called pairwise master key. Systems then use the key to encrypt data between them.
202
PEAP
Protected EAP
Extra layer of protection for EAP. Encapsulates the EAP conversation in TLS tunnel. Requires certificate on the server but no on the clients.
203
EAP-FAST
EAP-Flexible Authentication via Secure Tunneling
Built by Cisco. Supports certificates but they are optional.
204
EAP-TLS
Requires certificates on both the 802.1X server and the clients.
205
EAP-TTLS
EAP-Tunneling TLS
Extension of PEAP that allows systems to use older authentication methods such as PAP. Requires certificate on the 802.1X server but not the clients.
206
IEEE 802.1X
Requires users to authenticate when connecting to a wireless AP or plugging into a port. Can be implemented as a RADIUS or Diameter server. Supports usernames and passwords as well as certificates.
207
Enterprise mode
WPA2 mode. Forces users to authenticate with unique credentials when connecting to the network. Uses an 802.1X server, often implemented as a RADIUS server.
208
SAE
Simultaneous authentication of equals. Used in WPA3, variant of dragonfly key exchange which is based on diffie hellman.
209
RADIUS Federation
Creating a federation using 802.1X and RADIUS servers
210
WPS
Wi-fi protected setup.
Press a button on the printer to connect to its Hotspot. Enter a pin to connect your phone to the AP.
211
IV attacks
Discover the initialization vector and use it to discover the pre-shared key.
212
Bluebugging
Blursnarfing, but the attacker installs a backdoor. Allowing them to listen to comms, send messages, etc remotely from the victims device.
213
VPN Tunneling Protocols
1. IPSEC in tunnel mode
2. SSL/TLS
3. L2TP - Layer 2 tunneling protocol
214
IPSec tunnel mode
Used as a tunneling protocol to encrypt VPN comms. In this mode both the payload and headers of the IP packet are encrypted.
215
IPSec transport mode
Only the payload of the IP packet, not headers. Not used for VPNs usually unless you don't care about internal IPs being exposed.
216
ESP
Encapsulating security payload
Protocol number 50
Encrypts data in IPSec. Includes AH.
217
AH
Authentication header.
Protocol number 51.
Allows hosts in an IPsec communication to authenticate with each other before exchanging data.
218
VPN: Full tunnel
When connected to the VPN, all traffic regardless of destination will be tunneled through the VPN.
219
VPN: split tunnel
Admin determines which specific traffic should be tunneled through the VPN. Perhaps he will restrict it to traffic destined for the internal network only.
220
Site-to-site VPN
Uses two VPN servers to act as gateways for two geographically separated networks. The process of accessing resources in the remote network is seemless from the user's perspective.
221
Direct/remote access VPN
Allows users to access private networks via a public network. Process is NOT seemless to the user, as the user has to manually connect to the VPN server.
222
Always-on VPN
The VPN connection is established and maintained always. This opposes an on-demand connection. Can be used with both site to site VPN and direct access VPN.
223
HTML5 VPN Portal
Allows users to connect to the VPN using their web browser. Uses TLS to encrypt the session. Tends to be very resource intensive.
224
NAC
Network Access Control
Methods to ensure that devices connecting to a network meet certain predetermined characteristics. NAC will perform host health checks. Possibly via an agent. A VPN server will query the NAC (assuming there is one) and query the client for a health report before allowing the client to connect to the internal network.
225
VPN authentication methods
VPN should ensure that only authorized users access it.
1. PAP - Password Authentication Protocol
2. CHAP - Challenge Handshake Authentication Protocol
3. RADIUS
4. TACACS+
226
PAP
Password Authentication Protocol
Used in VPNs for authentication. Used with Point to point protocol (PPP) to authenticate clients. PAP allows users to authenticate with a password or PIN. However, it is sent over the network in cleartext, so it's not secure.
227
CHAP
Challenge Handshake Authentication Protocol.
Used by VPNs for authentication. Uses point to point protocol (PPP). CHAP allows users to authenticate with a shared secret. The client hashes the shared secret combining it with a nonce, and then sends it to the server. More secure than PAP because the shared secret is NOT sent in plaintext.
228
TACACS+
Terminal Access Controller Access-Control System Plus
Authentication system that is an alternative to RADIUS. Can be used by VPNs for authentication. Can be used with kerberos. Two essential security benefits over RADIUS: 1. Encrypts the entire authentication process. 2. Uses multiple challenges and responses between the client and the server.
229
AAA Protocols
Protocols that provide authentication, authorization, and accounting
1. RADIUS
2. TACACS+
3. Diameter
230
MDM
Mobile device management
Includes technologies to manage mobile devices.
231
UEM
Unified endpoint management
Ensure systems are up to date with patches, AV, and are secured with standard security practices. Can be used to manage mobile devices or any device.
232
NIST RMF
Mandatory framework for US federal agencies and organizations that handle federal data.
Six step process
1. Categorize: define the environment
2. Select: pick the appropriate controls
3. Implement: define proper implementation
4. Assess: determine if controls are working
5. Authorize: make a decision to authorize a system
6. Monitor: check for ongoing compliance
233
NIST CSF
NIST cybersecurity framework
Framework core
Identify, protect, detect, respond, and recover
234
ISO/IEC 27001
Information security management
Framework that provides information on infosec management system (ISMS) requirements. Three stage certification process for an organization to become compliant.
235
ISO 27002
Information technology security techniques
Complement to ISO 27001. While ISO 27001 identifies requirements to become certified, ISO 27002 provides organizational with be practices guidelines.
236
ISO 27701
Privacy information management system (PIMS)
Based on ISO 27001, outlines a framework for managing and protecting PII. Provides organizations with guidance to comply with global privacy standards, such as European General Data Protection Regulation (EU GDPR)
237
ISO 31000
Family of standards related to risk management. Provides guidelines that organizations can adopt to manage risk
238
SOC 2 Type I
A report that describes an organization's systems and covers the design effectiveness of security controls on a specific date. Design effectiness refers to how well the security controls address risks but not necessarily how well they work when mitigating risks.
239
SOC 2 Type II
Report that describes an organization's systems and covers security controls' operational effectiveness over a range of dates, e.g 12 months. Operational effectiveness refers to how well the controls worked when mitigating risks during the range of dates.
240
NIST SP 800-87
Risk Management Framework for Information Systems and Organizations
Covers the Risk Management Framework (RMF). Provides organizations a 7 step process to identify and mitigate risks.
1. Prepare
2. Categorize information systems
3. Select security controls
4. Implement security controls
5. Assess security controls
6. Authorize information systems
7. Monitor security controls
241
SLE
Single Loss Expectancy
Cost of any single loss.
242
ARO
Annual rate of occurrence
Indicates how many times the loss will occur annually.
243
ALE
Annual Loss Expectancy
How much loss is accrued from failures during the entire year.
ALE = SLE * ARO
244
Risk register
Detailed document listing information about risks. Typically includes risk scores along with recommended security controls to reduce the risk scores.
245
Risk matrix
Plots risk on a graph.
246
RPO
Recovery Point Objective
Identifies a point in time where data loss is acceptable, refers to databases.
247
MTBF
Mean Time Between Failures
Provides a measure of a system's reliability, usually represented in hours.
248
MTTR
Mean Time To Recover
Identifies the arithmetic mean time it takes to recover a failed system.
249
BIA
Business Impact Analysis
Important part or a Business Continuity Plan (BCP). Helps an organization identify critical systems and components that are essential to an organization's success.
250
BCP
Business Continuity Plan
Plan that includes disaster recovery elements that provide steps used to return critical functions to operation after an outage.
251
RTO
Recovery Time Objective
Maximum amount of time it can take to restore a system after an outage.
252
CA
Certificate Authority
Issues, manages, validates, and revokes certificates. Can be public like a large organization e.g Symantec or can be a single service running on a server within a private network.
253
Root certificate
First certificate created but the CA that Identifies it. If the root certificate is placed into the trusted root CA store, then all certificates issued by the CA will be trusted.
254
Intermediate CA
A CA that is created by a root CA to create certificates on the root CA's behalf.
255
Child CA
A CA that has certificates issued to it by an intermediate CA. The child CA then gives these certificates to end users and devices.
256
CSR
Certificate Signing Request
A request you send to a CA to have the CA create/sign a certificate on your behalf.
257
RA
Registration authority
Assists in the certificate registration process. Sometimes, it is found in large organizations. RA never issues certificates it only assists the registration process.
258
CRL
Certificate revocation list
Used by the CA to revoke a certificate before its expiration date.
259
OCSP
Online certificate status protocol
Allows client to query the CA with the serial number of the certificate. The CA will then respond with an answer of good, revoked, or unknown. Unknown could indicate that the certificate is a forgery.
260
Stapling
Part of Online Certificate Status Protocol (OCSP). The certificate presenter receives a time stamped OCSP response from the CA signed with a digital signature. The certificate presenter then appends/staples the timestamped OCSP response to the certificate during the TLS Handshake process. Which eliminates the need for clients to query the CA.
261
Public key pinning
Security mechanism designed to prevent attackers from impersonating a website using fraudulent certificates. When configured, the web server responds to HTTPS requests with an extra header which includes a list of hashes derviced from valid public keys used by the web site. When clients connect to the web server they recalculate the hashes and then compare the calculated hashes with the ones they have stored from before. If they match then the client knows this is the same web server.
262
Key escrow
Placing a copy of a private key in a safe environment. E.g giving the key to a third party
263
CER
Cannocial Encoding Rules
One of the base formats for certificates. E.g cert.cer
264
DER
Distinguished Encoding Rules
One of the base formats for certificates. E.g cert.der
265
PEM
Privacy Enhanced Mail
Certificate format, despite name can be used for anything.
266
P7B
Certificate format using PKCS version 7.
267
P12
Certificate format using PKCS version 12.
268
PFX
Personal Information Exchange
Certificate format, predecessor to P12.
269
CIRT
Computer Incient Response Team
270
AAAA Record
Holds hostname and IPv6 address, similar to A record but for IPV6
271
A record
Holds hostname and IPv4 address
272
PTR Record
Pointer record
Opposite of an A record. For when client queries DNS with an IP.
273
MX Record
Mail exchange record
Identifies a mail server used for email. Linked to A or AAAA record of the mail server. When there is more than one mail server, the one with the lowest preference number in the MX record is the primary mail server.
274
CNAME Record
Canonical name record
Allows single system to have multiple names associated with a single IP address.
275
SOA record
Start of authority record
Includes information about the DNS zone and some of its settings which are useful for clients to know. E.g TTL
276
Cyber kill chain
1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. C2
7. Actions on Objectives
277
Diamond model of intrusion analysjs
1. Adversary
2. Capabilities
3. Infrastructure - domain names, email addresses, ips, etc used by the adversary
4. Victim
278
MITRE ATT&CK
Adversarial Tactics, Techniques, and Common Knowledge
Knowledge base of tactics and techniques used in real-world attacks.
